A radio network includes two parts: radio access network (RAN) and core network. A Long Term Evolution (LTE) radio core network includes a Mobile Management Entity (MME). The functions of the MME are similar to the functions of a Serving General Packet Radio Service (GPRS) Supporting Node (SGSN), and include mobility management and user authentication. When a UE is in the idle state, the UE needs to negotiate the Non-Access Signaling (NAS) security algorithms with the MME, including the NAS encryption algorithm and the NAS integrity protection algorithm in order to ensure the system security in the communication process of the UE.
When the UE in the idle state moves in an LTE radio access network, or moves from a 2G/3G network to an LTE network, a Tracking Area Update (TAU) process occurs. In this process, the entity that performs mobility management and user authentication for the UE may change. For example, when the UE moves in an LTE network, the entity that performs mobility management and user authentication for the UE changes from the MME prior to moving (the old MME) to the MME subsequent to moving (the new MME). When the UE moves from a 2G/3G network to an LTE network, the entity that performs mobility management and user authentication for the UE changes from the SGSN to the MME. The security capabilities of different entities that perform mobility management and user authentication for the UE may differ. Therefore, the UE needs to renegotiate security capabilities with the new MME. For the LTE network, the negotiation of security capabilities between the UE and the MME is primarily negotiation of the NAS security algorithm and the corresponding key negotiation.
FIG. 1 is a flowchart of security capability negotiation between the UE and the MME in the prior art. As shown in FIG. 1, the method of security capability negotiation includes the following steps:
Step 100: The UE sends a TAU Request to the new MME.
In this step, the UE sends a TAU Request to the new MME through an evolution Node B (eNB) of the LTE radio access network. For ease of description in the following text, the message transferred by an eNB between the UE and the MME is simplified as communication performed directly between the UE and the MME.
Steps 101-102: The new MME sends a Mobility Management Context Request message to the old MME. After receiving the message, the old MME returns a Mobility Management Context Response message to the new MME, and this message carries the current root key “Kasme”, the current integrity protection key (Knas-int), the current NAS encryption key (Knas-enc), the current NAS security algorithm, and the security capabilities supported by the UE (including the NAS/Radio Resource Control (RRC)/User Plane (UP) security algorithm supported by the UE).
Step 103: According to the intersection of the NAS security algorithms in the UE's security capabilities, the NAS security algorithms supported by the new MME, and the NAS security algorithms enabled by the system, the new MME selects a new NAS security algorithm, including the NAS integrity protection algorithm and the NAS encryption algorithm.
Step 104: The new MME sends TAU Accept message to the UE. The message carries the selected new NAS security algorithm.
In practice, other steps, unrelated to security capability negotiation that occurs between step 103 and step 104, are omitted here.
Step 105: The UE receives the TAU Accept message that carries the selected NAS security algorithm to share the NAS security algorithm with the MME. Afterward, the UE checks the NAS security algorithm carried in the TAU Accept message. If the carried NAS security algorithm is the same as the NAS security algorithm currently used by the UE, the Knas-int and the Knas-enc currently used by the UE serve as the subsequent NAS protection key. If the carried NAS security algorithm is different from the NAS security algorithm currently used by the UE, a new Knas-int and a new Knas-enc need to be deduced according to the root key (Kasme) currently used by the UE and other parameters, and serve as the subsequent NAS protection key shared with the MME. In this way, the security capabilities are negotiated between the UE and the MME.
Evidently, no process of preventing “bidding down attacks” is performed in the prior art. A “bidding down attack” is described as follows: Supposing that the UE supports two security algorithms simultaneously (high-intensity algorithm A1 and low-intensity algorithm A2) and the MME also supports such two algorithms, the result of negotiation between the UE and the MME ought to be the high-intensity algorithm A1. However, if the security capabilities supported by the UE are modified by an attacker before the new MME knows the security capabilities supported by the UE, for example, if the attacker reserves only the low-intensity algorithm A2, the new MME has to select the low-intensity algorithm A2 and sends it to the UE. That is, the result of negotiation between the UE and the MME is not the high-intensity algorithm A1, but the low-intensity algorithm A2, which is more vulnerable to attacks, namely, bidding down attacks. Therefore, the prior art does not prevent bidding down attacks. The result of negotiation between the MME and the UE may be a low-intensity algorithm. Consequently, in the subsequent communication process, the communication between the UE and the MME is vulnerable to attacks, and the subsequent interaction between the UE and the network is not secure.